This is the first certification that requires you to locate IoT device(s) then gain access to the network. Once on the network, you’ll be challenged to identify the firmware of the IoT device, extract it, and then reverse engineer it by extracting the file system, analyzing the content and the files, mounting the file system, and booting it with Firmadyne.

The test contains a zone dedicated to ICS SCADA networks that you will have to penetrate from the IT network side and gain access to the OT network. Once there, you will have to identify the Programmable Logic Controller (PLC) and then modify the data to impact the OT network. To do this you must be able to intercept the Mod Bus Communication protocol and communication between the PLC and other nodes. If you can’t do that presently, then you should enroll in the CPENT program to learn!

Unlike other certifications, this will not just be a simple 32-bit code, but there will be 32- AND 64-bit code challenges and some of the code will be compiled with the basic protections of non-executable stacks. You must also be able to write a driver program to exploit these binaries then discover a method to escalate privileges. This will require advanced skills in binary exploitation to include the latest debugging concepts and egg hunting techniques. You must craft input code first to take control of program execution and second to map an area in memory to get your shellcode to work and bypass system protections.

The adoption of cloud computing in organizations is growing rapidly, which is why your ability to perform a cloud penetration test must be at it’s best! Checking for compliance and governance issues, checking if strong authentication is deployed for every remote user, checking data retention policy of service providers, performing automated cloud security testing, as well as AWS, Azure, and Google Cloud Platform penetration testing are just some of the thing you will be expected to be able to perform.

You will also be tested on your ability to perform WLAN penetration testing by discovering the wireless networks, detecting hidden SSIDs, sniffing wireless traffic, performing various attacks on the wireless network, cracking WEP, WPA, WPA2 keys, checking for MAC filtering, as well as penetrating RFID and Near Field Communication (NFC) systems.